Analysis
-
max time kernel
33s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 04:06
Static task
static1
Behavioral task
behavioral1
Sample
3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exe
Resource
win7-20240708-en
General
-
Target
3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exe
-
Size
20.6MB
-
MD5
2c096c46d1011d83c1617dfc1da3c4ef
-
SHA1
afe98a6b8d9a05b8e7eaa5d5eb36ff5abd1bf645
-
SHA256
3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c
-
SHA512
69cc2076efc119e4ae4ef0afe5d48ff8cbb0034caa78943f42a220a2929afd11a5d9f9a15710def565958973105d377b185d064d675d4e87a066040e7eb5b298
-
SSDEEP
98304:0kMaaxVrMnORUn/5Z6i7IB8sS4oYBoODZG9+5yU3jeluHMCaNEwp0o0/1cv:Oo/5Z6iIBnuceKMCb2
Malware Config
Extracted
lumma
https://sensitivyitszv.shop/api
https://bouncedgowp.shop/api
https://bannngwko.shop/api
https://bargainnykwo.shop/api
https://affecthorsedpo.shop/api
https://radiationnopp.shop/api
https://answerrsdo.shop/api
https://publicitttyps.shop/api
https://benchillppwo.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exedescription pid Process procid_target PID 4568 set thread context of 1340 4568 3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exe 86 -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exedescription pid Process procid_target PID 4568 wrote to memory of 1340 4568 3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exe 86 PID 4568 wrote to memory of 1340 4568 3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exe 86 PID 4568 wrote to memory of 1340 4568 3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exe 86 PID 4568 wrote to memory of 1340 4568 3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exe 86 PID 4568 wrote to memory of 1340 4568 3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exe"C:\Users\Admin\AppData\Local\Temp\3ff74f5275a2ed06959e63a3e321d051da4d7167efc3f6f3d80fbc134a187b3c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵PID:1340
-